GCVE-110-OSM-2026-13436

The OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This is a dependency-confusion attack with OAST-based install-time exfiltration. The postinstall.js executes immediately on npm install, constructs a DNS beacon from the victim's hostname and package name (encoding environment context into the subdomain), and resolves it against the attacker-controlled OAST endpoint `db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me` — a classic canary/callback mechanism used to confirm successful installation in targeted supply-chain attacks. The inflated version number 100.100.102 is a textbook dependency-confusion indicator designed to outrank an internal `kmf-i18n` package. The publisher `dot2027` has two other packages (kmf-vendor-pack, test-account-portal-fe) already flagged as malicious in OSM, confirming this is an active threat actor running a coordinated campaign against what appears to be a KMF/KSP organization's internal package namespace. The OSV advisory MAL-2026-17747 is confirmed accurate by the code evidence. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: ".oast.me" - Suspicious Domain in postinstall.js: "oast.me" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES postinstall.js